feat(workbench): persist operational workflows and events

app/auth/permissions.py

@@ -21,6 +21,14 @@ MODEL_IMPORT = "model.import"
 AUDIT_VIEW = "audit.view"
 ENVIRONMENT_MANAGE = "environment.manage"
 MEMBERSHIP_MANAGE = "membership.manage"
+OPERATIONAL_TASK_VIEW = "operational_task.view"
+OPERATIONAL_TASK_WRITE = "operational_task.write"
+OPERATIONAL_TASK_EXECUTE = "operational_task.execute"
+OPERATIONAL_TASK_EXTERNAL_SYNC = "operational_task.external_sync"
+OPERATIONAL_ACTION_WORK_ORDER_APPROVE = "operational_action.work_order.approve"
+OPERATIONAL_ACTION_WORK_ORDER_EXECUTE = "operational_action.work_order.execute"
+OPERATIONAL_ACTION_COMMAND_APPROVE = "operational_action.command.approve"
+OPERATIONAL_ACTION_COMMAND_EXECUTE = "operational_action.command.execute"
 
 PROJECT_MEMBER_PERMISSIONS = frozenset(
     {
@@ -36,6 +44,10 @@ PROJECT_MEMBER_PERMISSIONS = frozenset(
         RISK_RUN,
         OPTIMIZATION_VIEW,
         OPTIMIZATION_RUN,
+        OPERATIONAL_TASK_VIEW,
+        OPERATIONAL_TASK_WRITE,
+        OPERATIONAL_ACTION_WORK_ORDER_APPROVE,
+        OPERATIONAL_ACTION_WORK_ORDER_EXECUTE,
     }
 )
 
@@ -44,6 +56,7 @@ PROJECT_VIEWER_PERMISSIONS = frozenset(
         WEBGIS_VIEW,
         SCADA_VIEW,
         SIMULATION_VIEW,
+        OPERATIONAL_TASK_VIEW,
     }
 )
 
@@ -53,6 +66,15 @@ SYSTEM_ADMIN_PERMISSIONS = frozenset(
         AUDIT_VIEW,
         ENVIRONMENT_MANAGE,
         MEMBERSHIP_MANAGE,
+        OPERATIONAL_TASK_EXECUTE,
+        OPERATIONAL_TASK_EXTERNAL_SYNC,
+    }
+)
+
+SYSTEM_SERVICE_PERMISSIONS = frozenset(
+    {
+        OPERATIONAL_TASK_EXECUTE,
+        OPERATIONAL_TASK_EXTERNAL_SYNC,
     }
 )
 
@@ -71,6 +93,15 @@ def resolve_permissions(
     permissions = set(PROJECT_ROLE_PERMISSIONS.get(project_role or "", frozenset()))
     if is_superuser or system_role == "admin":
         permissions.update(SYSTEM_ADMIN_PERMISSIONS)
+        if project_role == "member":
+            permissions.update(
+                {
+                    OPERATIONAL_ACTION_COMMAND_APPROVE,
+                    OPERATIONAL_ACTION_COMMAND_EXECUTE,
+                }
+            )
+    elif system_role == "service" and project_role == "member":
+        permissions.update(SYSTEM_SERVICE_PERMISSIONS)
     return frozenset(permissions)